GDPR for Solo Professionals — What You Actually Need to Know

If you're a lawyer, therapist, accountant, or notary working independently in the EU, GDPR applies to you. Not just to large companies. Not just to hospitals or banks. To you, personally, as someone who handles other people's data as part of your work. This page explains what that means in practice — without the legal jargon.

Do I actually need to comply with GDPR?

Yes, if you process personal data in the course of your professional activity. Personal data means any information that can identify a living person — a client's name, email address, phone number, health record, financial detail, or case file. As a solo professional, you almost certainly process personal data every day. That makes you a data controller under GDPR — the person legally responsible for how that data is collected, stored, used, and protected.

What does GDPR actually require from me?

There are five things most solo professionals need to have in place. First, a lawful basis for processing data — you need a legitimate reason to hold client data, either contractual necessity or legal obligation, and you must know which applies to each type of data you hold. Second, a privacy notice — your clients have the right to know what data you collect, why, how long you keep it, and who you share it with. Third, data minimisation — only collect data you actually need. Fourth, security measures — protect personal data against unauthorized access, loss, or breach, through both technical and organizational controls. Fifth, a breach response plan — if personal data is compromised, you may be required to notify ANSPDCP within 72 hours.

What are the most common GDPR mistakes solo professionals make?

Using personal email for client communication — Gmail, Yahoo, and similar consumer services are not appropriate for handling sensitive client data. No written data processing agreement with software vendors — if you use cloud software, you need a Data Processing Agreement with each vendor. Keeping data longer than necessary — GDPR requires deletion or anonymization once you no longer need data, and you need a retention policy. No record of processing activities — while solo professionals below certain thresholds may be exempt, maintaining a Record of Processing Activities is considered best practice and protects you if audited.

Does NIS2 also apply to me?

Possibly. NIS2 is a newer EU directive focused on cybersecurity resilience. It primarily targets medium and large organizations in critical sectors, but its scope is broader than many professionals realize — and Romania is in the process of transposing it into national law. If you work in healthcare, legal services, or financial advisory, it is worth understanding whether NIS2 obligations apply to your practice. We cover this in detail in our NIS2 guide for licensed professionals.

How do I know if my current security posture is good enough?

Honestly, most solo professionals do not know — and that is the problem. GDPR does not prescribe specific technical measures; it requires measures that are appropriate to the risk. Determining what that means for your practice takes time and expertise most professionals do not have. Solsignia Postura was built specifically for this. It asks you the right questions about how you handle data, maps your answers to your actual GDPR and NIS2 obligations, and gives you a prioritized action list — not a generic checklist, but one tailored to your profession and situation. You get a living security score that reflects your current posture, a trust badge you can display to clients when your score is strong, and a PDF report you can keep as evidence of compliance effort.